IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF MARYLAND 

UNITED STATES OF AMERICA 

V. 

HAROLD T. MARTIN, HI 

MOTION FOR DISCOVERY PURSUANT TO SECTION 4 
OF THE CLASSIFIED INFORMATION PROCEDURES ACT 

Defendant Harold T. Martin, III, through counsel, writes pursuant to Section 4 of the 

Classified Information Procedures Act (“CIPA”), 18 U.S.C. App. Ill, to renew his request for a 

Court Order requiring the government to produce: (1) mirror images of the devices used to create 

the “Library,” an electronic database created by the National Security Agency (“NSA”) which 

contains some information from certain electronic storage devices seized from Mr. Martin’s 

residence; and (2) mirror images of the computers containing operating systems seized from Mr. 

Martin’s residence (collectively, “mirror images”).^ 

INTRODUCTION 

The defense renews our request for mirror images because, despite the government’s 
assurances to the contrary, we have determined that the Library does not contain the functional 
equivalent or near equivalent of mirror images of the electronic devices. See Ex. 1 (Affidavit of 
Larry Daniel). As a result, it is impossible for us to independently review the government’s 
electronic evidence or test the government’s computer forensic analysis, which is set forth in two 
expert reports authored by the NSA. S^ Ex. IB (Eeb. 28, 2018 Report); Ex. 1C (Oct. 9, 2018 
Report) (filed separately via CISO). 


* 
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A “mirror image” is an exact copy of a computer hard drive or external hard drive without 
any data removed, missing, altered, or added. 
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At the August 17, 2018 hearing, the Court ordered that we have meaningful aeeess to the 
eleetronie discovery. After much on-the-record discussion, it was understood that the electronic 
Library made available to us at the NSA would afford us meaningful access to the electronic 
discovery such that we could test the government’s expert analysis and conduct our own 
independent analysis. As it turns out, we are unable to do either. Simply put, we are unable to test 
or rebut the government’s evidence. 

Without mirror images or their functional equivalent, we are forced to accept the 
government’s expert forensic reports at face value. This is problematic because the forensic 
reports will be a centerpiece of the government’s case at trial. Adding further concern is the 
government’s stated intent to provide rolling supplements to the expert reports. As it currently 
stands, the defense will not know the entire substance of the reports until mere weeks, or perhaps 
days, before trial. Indeed, the government recently supplemented its 16-page February 28, 2018, 
forensic report with a 104-page forensic report provided on October 9, 2018—nearly two months 
after the August 17, 2018, expert disclosure deadline set forth in the Court’s July 3, 2018, 
scheduling Order. The government’s rolling expert report disclosures, combined with its failure 
to provide the defense with the functional equivalent of mirror images, runs afoul of the Court’s 
August 17, 2018, Order, the scheduling Order, Federal Rule of Criminal Procedure 16, due 
process, and the repeated, on-the-record assurances of the government that it will provide the 
defense with meaningful access to the electronic discovery in this case. 

Nearly a year after we first raised this issue with Judge Garbis, and more than two years 
after Mr. Martin was arrested, we still have not been given the discovery we need to test and rebut 
the government’s computer forensic analysis. The government, meanwhile, has spent two years 
conducting its forensic analysis and is poised to continue updating its expert reports until the eve 
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of trial. The government’s inadequate expert disclosures make it impossible for us to effectively 
prepare Mr. Martin’s defense and place the trial schedule at risk. The Court should order the 
government to comply with its August 17, 2018, ruling by providing mirror images for the 
defense’s review in a secure government facility. The Court should also bar the government from 
producing any additional expert discovery or relying on any computer forensics analysis that it has 
not already disclosed in the reports dated February 28, 2018, and October 9, 2018. 

BACKGROUND 

On August 17, 2018, the Court presided over a hearing to determine the scope of the 
defense’s access to electronic files allegedly seized from Mr. Martin. The Court agreed that the 
electronic files are relevant and helpful to Mr. Martin’s defense and that the defense must have 
meaningful access to them. The sole question was whether the government’s proposed protocol 
for the defense’s examination of the electronic files ensured meaningful access. See Ex. 2 
(Protocol for Defense Examination of Electronic Data Seized from the Defendant). 

At the hearing, the Court stated repeatedly its intent to provide the defense with access to 
the functional equivalent of mirror images, so that we may conduct an independent forensic 
examination of the electronic files. See Aug. 17, 2018, Hr’g Tr. at 74:1 (“[MJirror images are 
going to be produced for you.”); id. at 80:25-81:2 (“[T]he Government is providing access to 
images of the digital media within the library. I interpreted that to be essentially mirror images.”); 
id. at 83:19-20 (“So you have access to the mirror image . . . .”). The government, over and again, 
assured the Court that its proposed protocol ensured defense access to the functional equivalent of 
mirror images. See, e.g., id at 82:14-17 (“What they’re instead getting is all of the data that is on 
that device is put into the system that they will be given, and they’ll be able to see all of things 
we’ve talked about, except for the content of the files ....”). According to the government, under 
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the proposed protocol, the defense would have access through the Library to “all of the data and 
all of the data about that data.” Id at 83. The only thing the Library would not contain, the 
government explained, is the actual content of the files, and the defense could request particular 
files or seek Court intervention to obtain them. Id 

Based on the government’s representations, the Court granted the government’s motion 
pursuant to CIPA section 4, as modified by its protocol for the defense’s examination of electronic 
files. The Court acknowledged that, after traveling to the NSA to see the Library, the defense 
“may not be satisfied” and, if so, could seek Court intervention under CIPA Section 4. Id at 59; 
see also id at 63; 12-13 (“The first step is for [the defense] to go out there [to the NSA] and start.”). 
Finally, the Court set a deadline of September 25, 2018, for the government to produce any 
classified materials, other than the twenty charged documents, which it intends to introduce at trial. 
See id. at 65:2-4 (“We are not going to have rolling document production, and we’re not going to 
have supplementation.”); jd at 72:17-19 (“We are not having rolling discovery. We are not having 
rolling documents, and people are going to have to do their homework early here. That’s all there 
is to it.”). 

ARGUMENT 

Upon the defense’s review of the Library with our cleared computer forensics expert, Larry 
Daniel,^ we have determined that, despite the government’s previous representations at the August 
17 hearing, we have not been provided mirror images or the functional equivalent or near 
equivalent of mirror images. Because of this, we are unable to independently review the 
government’s evidence, and we cannot test the government’s expert forensic reports. Moreover, 
the government’s stated intent to provide rolling updates to the forensic reports have raised 


Mr. Daniel’s CV is attached as Exhibit 1 A. 
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additional concerns. The government is not eomplying with the Court’s seheduling Order or its 
clear intent to avoid “rolling doeument production.” The Court should order the government to 
promptly produee mirror images for the defense’s review in a seeured government spaee and bar 
the government from produeing or relying on any additional expert diseovery. 

I. A Trip to the NSA with Our Expert Revealed the Library’s 
Insufficiency. 

The defense only diseovered the issues with the Library after traveling to the NSA with 
Mr. Daniel. As explained by Mr. Daniel, upon familiarizing himself with the Library (referred to 
as the “Repository” in his affidavit), he determined that the Library is “the government’s work 
product.” Ex. 1 at ][ 5. In Mr. Daniel’s words; “[T]he Repository is the summary of the 
government’s forensie analysis. The Repository does not allow me to review the aetual evidenee. 
It only allows me to review the government’s summary of the evidenee.” Id Because of this, Mr. 
Daniel is in the impossible position of trying to test the government’s evidenee using the 
government’s work product. See id. at 5-6, 14. He cannot perform independent forensie 
analysis or test the government’s expert reports. 

II. Like the Government’s Experts, Our Expert Needs Access to Mirror 
Images. 

To conduct his own analysis, Mr. Daniel needs mirror images. Access to mirror images of 
the 24 digital storage devices—which are the subject of the government’s expert reports—would 
enable Mr. Daniel to attempt to recreate the NSA’s work and, therefore, test the conclusions in its 
expert reports. See id at 11-12. The NSA has mirror images of the devices and, in fact, relied 
on mirror images of the devices in creating the Library. The government’s experts apparently 
relied on mirror images in drafting its forensic reports. See, e.g. . Ex. 1C at 24, 52, 70, 73, & 91. 
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Providing copies of the mirror images for the defense’s review, in a suitable government- 
controlled space, is only fair and would not be logistically difficult. 

Ill, Under the Current State of Affairs, the Defense Does Not Have Access 
to Critical Evidence, 

A, We Cannot Visualize the Contents of Storage Devices Where 
the Charged Documents Were Allegedly Found, 

In its October 9 expert report, the NSA ineluded many “visualizations” of where doeuments 
were stored in partieular devices. S^Ex 1 at T111; see, e.g.. Ex. 1C at 24, 52, 70, 73, & 91. These 
are essentially sereenshots of the file direetories on Mr. Martin’s deviees. We eannot see them or 
reereate them under the government’s protoeol. The Eibrary that we have aecess to is a blaek 
screen with a blinking eursor. We eannot see the file strueture. The government ean and has 
produeed eompelling images of the file strueture in its expert report. These images or 
visualizations are eritieal to the government’s ease at trial, as it will presumably argue that Mr. 
Martin knowingly possessed national defense information beeause his personal files (e.g., resume, 
graduate thesis) were saved in elose proximity to files eontaining alleged national defense 
information. To bolster this argument, the government will show the jury the visualizations 
eontained in its Oetober 9 expert report. With our aeeess to digital files limited to the Eibrary, we 
have no ability to test whether the visualizations are eorrect or develop our own visualizations. As 
Mr. Daniel explains, the “visualizations are not in the [Eibrary], and it is not possible to ereate 
those visualizations using the [Library].” Ex. 1 at ][ 11. Mr. Daniel needs mirror images of the 24 
digital storage deviees referenced in the NSA’s forensie reports to ereate the visualizations. 

B, The Defense Needs Mirror Images of Mr, Martin’s 
Computers that Contain Operating Systems, 

Mr. Daniel also needs mirror images of the eomputers eontaining operating systems seized 
from Mr. Martin’s residenee. These mirror images are “eritieal to [his] analysis,” beeause 
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operating systems (sueh as Microsoft Windows for a PC) contain a “wealth of information about 
files on connected storage devices.” Id at ][][ 8-10. This critical information is not in the Library. 
For example, operating systems such as Microsoft Windows store unique information about files, 
including when the computer accessed a fide, who accessed the file, when a storage device was 
connected to the computer, and the program used to open and view the contents of the file. Id at 
T1 9. All of this information is crucial to Mr. Martin’s defense, but none of it is in the Library. Id 

On a more technical level, we identified a number of computer artifacts at the August 17 
hearing that we expected to see in the Library and that our expert needed access to for his 
independent analysis. In particular, we read into the record that we needed operating system 
registry, jump lists, user assist, unallocated space, memory or pagefile.sys, dump fdes, web history, 
shell bags, prefetch, compound files, SQL databases, links data, data carving, events logs, volume 
shadow copes, Microsoft Office document metadata, and meta carving. Aug. 17, 2018, Hr’g 
Tr. at 80:9-14. None of these computer artifacts, however, is in the Library. Ex. 1 at ][][ 8-10; see 
also Ex. 3 (Sept. 5, 2018 Email from AUSA Myers). 

IV. The Defense’s Computer Expert Cannot Move Forward. 

As it currently stands, Mr. Daniel cannot do any of the crucial tasks he has been retained 
to do. Ex. 1 at ][ 2. He cannot conduct his own independent forensic analysis. Id He cannot test 
the conclusions contained in the government’s expert reports. Id Moreover, because the 
government intends to continue supplementing its expert reports without limit, Mr. Daniel is not 
even guaranteed sufficient time to test the expert reports and relay his findings to defense counsel 
prior to trial. If the Court does not intervene, Mr. Martin will be forced to go to trial without a 
complete understanding of the government’s evidence or the opportunity to test and rebut it. The 
Court cannot tolerate such a result. The Court should order the immediate production of mirror 
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images of the devices used to create the Library and mirror images of the computers containing 
operating systems seized from Mr. Martin’s residence. 

CONCLUSION 

For the reasons stated above, the Court should order the government to immediately 
produce (1) mirror images of the devices used to create the Library and (2) mirror images of the 
computers containing operating systems seized from Mr. Martin’s residence. The Court should 
also bar the government from producing or relying on any additional expert discovery. 


Respectfully submitted, 
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Federal Public Defender 
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